CVE-2021-36513
📋 TL;DR
This vulnerability in SignalWire FreeSWITCH allows attackers to view sensitive information due to an uninitialized value in the sofia_handle_sip_i_notify function. It affects FreeSWITCH installations before version 1.10.6. Attackers could potentially access memory contents that should remain confidential.
💻 Affected Systems
- SignalWire FreeSWITCH
📦 What is this software?
Freeswitch by Signalwire
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive information from memory, potentially exposing credentials, configuration data, or other confidential information stored in the FreeSWITCH process memory.
Likely Case
Information disclosure of uninitialized memory contents, which could include fragments of previous SIP messages, configuration data, or other process memory.
If Mitigated
Limited information disclosure with proper network segmentation and access controls preventing external attackers from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires sending specially crafted SIP NOTIFY messages to vulnerable systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.6
Vendor Advisory: https://github.com/signalwire/freeswitch/releases/tag/v1.10.6
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop FreeSWITCH service. 3. Upgrade to FreeSWITCH 1.10.6 or later. 4. Restart FreeSWITCH service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable SIP NOTIFY handling
allTemporarily disable SIP NOTIFY message processing to prevent exploitation
# Modify sofia.conf to remove or comment NOTIFY handling
# Requires configuration changes specific to your setup
Network filtering
linuxBlock SIP NOTIFY messages at network perimeter
# Example iptables rule: iptables -A INPUT -p udp --dport 5060 -m string --string "NOTIFY" --algo bm -j DROP
# Adjust for your specific SIP ports and protocols
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FreeSWITCH from untrusted networks
- Deploy network-based intrusion detection/prevention systems to monitor for SIP NOTIFY exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check FreeSWITCH version: freeswitch -version or examine package version. If version is earlier than 1.10.6, system is vulnerable.Check Version:
freeswitch -version 2>/dev/null | head -1 || dpkg -l | grep freeswitch || rpm -qa | grep freeswitchVerify Fix Applied:
Verify FreeSWITCH version is 1.10.6 or later and test SIP NOTIFY functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Unusual SIP NOTIFY messages in FreeSWITCH logs
- Memory access errors or segmentation faults related to sofia_handle_sip_i_notify
Network Indicators:
- SIP NOTIFY messages with unusual content or from unexpected sources
- Multiple NOTIFY messages to the same endpoint in short time
SIEM Query:
source="freeswitch.log" AND "NOTIFY" AND ("error" OR "fault" OR "segmentation")🔗 References
- https://github.com/signalwire/freeswitch/issues/1245
- https://github.com/signalwire/freeswitch/releases/tag/v1.10.6
- https://newreleases.io/project/github/signalwire/freeswitch/release/v1.10.6
- https://github.com/signalwire/freeswitch/issues/1245
- https://github.com/signalwire/freeswitch/releases/tag/v1.10.6
- https://newreleases.io/project/github/signalwire/freeswitch/release/v1.10.6
